Jetty error

[Anonymous]

I have configure my SA server with an ip address like 192.168.1.31 netmask 255.255.255.0 and gateway 192.168.1.1

these are the working network perameters.

but when i tried to access my SA server through GUI then i got 503 error powered by jetty.

as SA tell us for this we have to run command

stop jettysrv and start jettysrv

i did the same but still i am facing the same error.

my sa server version is 10.2

I am having three sa server rest of two working properly without any error but this one troublimg me so,

can anyone help me to resolve this error

[Anonymous]

hi patriot,

have any idea about this?

[Anonymous]

This means that your admin password is changed and that is the reason you cannot do appliance level tasks.  Do you know what the password was changed to?  By default it is netwitness. 

Alternatively, to fix the issue currently.  Go to your devices page and edit the username "admin" and  reset the password to netwitness, you need to do this on every device for now. 

Once you have done this, go into administration -> system -> security.  Update the password to netwitness in that menu too.  After you do this, reboot the systems to ensure the effect takes place.  Let me know if this fixes the issue. 

Also after this, you should be able to ssh to the box and run the same command to check if admin is allowed access to NwConsole.

[Anonymous]

hi ,Sean

thanks for your support, but i got that messages file under /var/log was oversized so we just move the file and create a new fresh copy of messages file and then restart the decoder and got that issue is resolved, now showing device is available and added logcollector successfully.

[huanzhou1]

interesting, disk full caused the nwappliance stop responding.

great you had your issue resolved.

[Anonymous]

well, thanks for support

[Anonymous]

Very odd to see this in a modern appliance.  I know the older version of SQL auditing would kill servers if the log got full and EnVision would kill services if the C drive got full. 

[Anonymous]

Hi ,

i want to get an alert when a user try to attempt logon on a single destination user or IP more then 5 time in 2 min, for this i create rule on decoder correlation tab (as per attached screen shot) but still i am not getting where i will get the output. or can we set any output action as SMTP

can you please guide me on this.